Schedule I: SSL and Security Services

1.1This Schedule applies to security-related services supplied by Hosting UK, including SSL certificates, malware scanning, security tools, vulnerability-related services, firewall services, monitoring tools and related add-ons.

2.1Security Services may vary by package and may include scanning, alerting, certificates, configuration assistance, filtering, monitoring or reporting.

2.2The specific features included are those described in the Order or relevant product description.

3.1No Security Service can guarantee that the Customer's services will be free from vulnerabilities, compromise, malware, unauthorised access, data loss, security incidents or malicious activity.

3.2Security Services are part of a wider security approach and are not a replacement for Customer security controls, patching, access management, monitoring or backups.

4.1The Customer remains responsible for applications, code, users, passwords, content, patching, configuration and security decisions except to the extent expressly included in a Managed Service.

4.2The Customer shall promptly act on security alerts, recommendations and remediation steps provided by Hosting UK.

5.1Security alerts may be automated, advisory or based on third-party data and may contain false positives or false negatives.

5.2Remediation work is not included unless expressly stated and may be chargeable.

6.1Hosting UK may suspend, restrict, isolate, remove or disable compromised content, services or accounts where reasonably necessary to protect the platform, network or other customers.

6.2Hosting UK is not liable for loss caused by compromise, malware, unauthorised access or actions taken reasonably to mitigate a security incident.

7.1Some Security Services may be supplied using third-party tools or data feeds and are subject to third-party availability, accuracy and terms.

7.2Hosting UK may change the security tooling used to provide the Service where reasonably required.

8.1Security Services do not include penetration testing, forensic investigation, legal advice, regulatory compliance advice, incident response retainer services or breach notification services unless expressly agreed in writing.